sourcecode 3.8.0__tar.gz → 4.0.1__tar.gz

{sourcecode-3.8.0 → sourcecode-4.0.1}/CHANGELOG.md

@@ -2,6 +2,186 @@
 
 ## [Unreleased]
 
+## [4.0.1] — 2026-08-02
+
+Patch, and the criterion is the one this project has used since 3.2.0: nothing here
+moves a published field, an exit code or a default. Three surfaces stopped
+misdescribing an engine that did not change — the release advertised half its own
+security ruleset, the front page led to neither capability the field asked for by
+name, and the document both of them call the full command reference covered fewer
+than half the commands. All three were found in-house.
+
+### Fixed
+
+- **`spring-audit --help` advertised three security rules and the build ships six**
+  (C4-9). The one-liner the root panel prints, and the command's own screen, said
+  `security surface (SEC-001..003)` two releases after CL-9 shipped SEC-004, SEC-005
+  and SEC-006; `docs/PRODUCT_TIERS.md` said `TX-001..005 + SEC-001..003` and
+  `docs/USER_GUIDE.md` said `TX-001..TX-005`. The engine was right in every case —
+  the product advertised half its ruleset, in the release that answered the field's
+  complaint about security recall. `sourcecode/rule_catalog.py` now holds one summary
+  line per rule and the help renders from it, while the id *set* is derived from the
+  shipped pattern registries by `tests/test_rule_catalog.py`: a seventh rule fails the
+  build until it is documented, and no surface may name a rule the build cannot emit.
+  The non-coverage block in the same help is rendered from `non_coverage` too, which
+  had a renderer with no consumer beside four rows restated by hand.
+- **The front page did not lead to either remedy that C4-8 closed** (C4-10). The
+  pointer lived in the payload that states the limitation, which reaches an agent and
+  not a reader who has not run the command yet — the same reader who wrote
+  `ask posture --provenance` and `ask contracts init` by hand after a full session.
+  `ask --help` now renders a *Questions the repository alone does not answer* block
+  from `remedies.REMEDIES`, and lists `risk .` in Start here; the README carries
+  `--resolve-environments`, `verify --init` and `ask risk` in the Quickstart,
+  `--resolve-environments` in §5b beside the `--diff` it qualifies, and a §5c for
+  composed risk. `tests/test_remedies.py` fails when a remedy is absent from either
+  surface.
+- **The "full command reference" documented 14 of 32 commands** (C4-11). `verify`,
+  `verify-edit` and `pr-impact` — the three gate commands — appeared only as names in
+  the tier table, and eight more had no occurrence in the file at all. Sections added
+  for the gate family (with the exit-code contract they share), for `plan`, `compare`,
+  `delta` and `contract-diff`, and a table for the rest.
+  `tests/test_user_guide_coverage.py` takes the command population from the CLI and
+  parses every invocation the guide prints against it.
+
+## [4.0.0] — 2026-08-02
+
+Major because two published `gate_coverage` fields are removed, not because the
+engine changed shape: `total_controller_handlers` / `gate_bearing` /
+`not_carrying_gate` (C2-14, the announced end of their two-minor window) and
+`possibly_filter_covered` (C1-20, which had no window — it counted the wrong thing).
+`removed_fields` in the same block maps each retired name to its successor.
+
+This release closes fourteen of the sixteen rows opened by the seventh field
+evaluation, in the order that record argued for, and ships `ask risk` — the first
+command that composes the other answers instead of adding one.
+
+### Added
+
+- **`ask risk` — the composition layer** (M10 head; [EXPERIMENTAL]). The seventh
+  evaluation's thesis was *"ASK tiene todos los átomos y no forma moléculas"*: one
+  class was `medium` in `spring-audit`, `medium/5.0` in `impact-chain`,
+  `coverage_unknown → permit_all` in `posture`, and executed a stored procedure that
+  mutates the database. Composed, that is unauthenticated write access under the
+  release build; separately, it was two commands saying "medium" and a reader doing
+  the join by hand.
+  `severity_effective = defect_severity × reachability × auth_verdict × write_effect`,
+  emitted as an ordered list. No new analysis — every factor is read from the
+  authority that already publishes it, and every row carries its four factors with
+  their sources, so a reader can reject one and keep the rest. An axis that could
+  not be measured is `unknown`, multiplies by 1.0, and is named in `blind_axes`:
+  the composition may not invent what nobody measured. This is the item that
+  *"crea producto"* rather than correcting data, and the one nobody replicates by
+  combining three scanners, because none of them shares an endpoint id with the
+  others.
+
+- **Three textbook security rules, because silence has to mean something** (CL-9).
+  The seventh evaluation got one security finding out of 3 342 files, then found
+  three more by hand in three files ASK had pointed it at. `SEC-004` (passwords
+  stored under a fast unsalted digest), `SEC-005` (CSRF disabled under
+  session-bearing authentication) and `SEC-006` (a cookie created without the Secure
+  attribute) ship in the `spring-audit` security surface, from one scan
+  (`sourcecode/security_config_scan.py`) with `file:line`. Each requires a
+  security-configuration context, so SHA-1 over a response body stays an ETag and a
+  stateless API that disables CSRF is not reported — a rule that cannot tell those
+  apart is one teams switch off, after which it protects nothing. These are table
+  stakes rather than differentiation: closing them avoids losing the sale.
+
+- **A third verdict for a gate that authorises against an identity nobody proved**
+  (C1-21). 939 endpoints in the field were reported `protected_custom` for carrying a
+  real gate — whose aspect resolves the caller through a method that returns a
+  database user when the authentication is null. The check runs; what it decides on,
+  for a request carrying no credential, is an identity the application invented, and
+  the vocabulary had no way to say so.
+  - `sourcecode/identity_fallback.py` (extractor) reports a method that reads the
+    platform's identity and, in a branch guarded by that identity being absent,
+    returns one anyway. Throwing, denying and returning null are correct handling and
+    are never reported; nothing branches on a method or class name (VAI).
+  - `security_posture` follows the enforcement path — types carrying published AOP
+    advice vocabulary or implementing a request-chain SPI — over `calls` edges, and
+    emits `protected_custom_degraded` (confidence `RequiresManualReview`) with an
+    `identity_resolution` block naming the method, the absence test and what it
+    returns. A fallback the enforcement path does not reach is not charged to the
+    gate.
+
+- **The remedy travels with the limitation** (C4-8, C3-37). The evaluation's requests
+  #1 and #5 — written by hand with invented syntax — are `posture
+  --resolve-environments` and `verify --init`, both shipped in the build it audited.
+  Four earlier rows say the same thing: discoverability cannot live in a document,
+  because a reader looking at an output does not go and read `--help`. One registry
+  (`sourcecode/remedies.py`), keyed by the question rather than by the flag, is read
+  by `posture.activation`, `posture --diff`, the `security_posture` limitation that is
+  conditional on the profile set, and `verify`'s exit-2 reason. A test refuses any
+  remedy naming a command or option the CLI does not accept, so a renamed flag breaks
+  the build instead of sending a reader to an invocation that no longer exists.
+
+- **A filter that matches a path is not a filter that checks the caller** (C1-20).
+  `gate_coverage` published `possibly_filter_covered: 2635` over patterns `/*`,
+  `/api/*` and `/api/v1/*` — and those three filters were CORS, headers and logging,
+  while the only filter that authenticates covered two prefixes. The wording was
+  technically honest and the number was still *"falso consuelo"*: the corrected split
+  on that repository is 12 covered against 2 623 in the gap. Both halves of the join
+  were already in the same process, so the fix is an intersection **per filter**
+  rather than per pattern-set:
+  - `sourcecode/filter_surface.py` now records each declared filter (`@WebFilter`, and
+    `web.xml` mappings correlated with their `<filter-class>`) with a verdict —
+    `authenticates`, `does_not_authenticate`, `unknown` — decided structurally, never
+    by name (VAI): the filter establishes an identity, or it reads a credential *and*
+    refuses over it. A body that is not in this repository stays `unknown`, because
+    absence of evidence published as evidence of absence is the same defect mirrored.
+  - `gate_coverage` replaces the single count with four that partition the escape set:
+    `filter_covered_authenticating`, `filter_gap_non_authenticating`,
+    `filter_authentication_unknown`, `no_matching_filter_pattern`, plus a `filters`
+    list naming each filter, its patterns and the evidence behind its verdict.
+
+- **Seven presentation rows, none of them an analysis error, two of which led a
+  reader to the inverse conclusion** (C2-15…C2-20, C1-19).
+  - `validation` printed *"0 body endpoints, 1179 gaps"* over a payload carrying
+    `body_endpoints_in_code: 1201` — the declared-constraint count under the
+    code-surface name. Both axes are named in their own units (C2-15).
+  - TX-006's witnesses all carried the callee's line, because that is where the
+    remedy goes, so several rows shared one number and read as duplicates. Each
+    finding now carries its `call_site` from the IR's span index, and the defect row
+    publishes the distinct sites with their count (C2-16).
+  - `limitations` merged across scopes repeated an entry verbatim; deduplicated once
+    in `finalize`, in first-seen order (C2-17).
+  - `spring_profiles.conditional_beans[].source_file` used the platform's native path
+    separator while the rest of the document used `/`; posix everywhere, including the
+    two other extractors that did the same (C2-18).
+  - `estimated_effort_range_days` published `{low: 60.7, high: 60.7}` — not a range,
+    at a precision the model does not have. The band declares `point_estimate` and
+    `precision_days`, and rounds to it (C2-19).
+  - `posture` cut four endpoint lists and its evidence map at 200 and declared
+    nothing, in the command whose declared caps the same evaluation calls a feature.
+    Each cut publishes total/shown/omitted and the registered cap effect; a list that
+    was not cut declares nothing (C2-20).
+  - Three commands published a file count for one repository — 3 337, 3 336, 3 342 —
+    and none said what it counted. Measured rather than equalised: all code-extension
+    files in any language, the non-test denominator of a test ratio, and the `.java`
+    files handed to the migration rules. Each names its population (C1-19).
+
+- **`cache status` counts every store a warm fills** (C3-36). It printed `CAS blobs:
+  0`, `Total size: 0.1 MB` immediately after an 89-second warm of 3 342 files: true of
+  the per-repository core store, and the warm's output mostly lands in the shared
+  Canonical IR and the content-addressed parse cache, which the command never counted.
+  The status now breaks down by store, says what each holds, and labels the parse
+  cache shared across repositories so its size is not read as this repository's.
+
+### Removed
+
+- **BREAKING — `gate_coverage` no longer emits the three deprecated aliases** (C2-14).
+  `total_controller_handlers` counted *endpoints* under a name that says handlers,
+  `gate_bearing` counted *handler methods* while sitting beside an endpoint count, and
+  `not_carrying_gate` duplicated `endpoints_not_carrying_gate`. They were kept for a
+  two-minor window after C1-5 named the units; the seventh field evaluation read the
+  aliases anyway and quoted `total_controller_handlers: 3574` as handlers next to
+  `handler_methods_total: 913`. An alias that still ships is a live claim, and two of
+  these claimed the wrong unit. Read `endpoints_total`,
+  `handler_methods_carrying_gate` and `endpoints_not_carrying_gate`; the block now
+  carries `removed_fields` mapping each retired name to its successor, so a consumer
+  meets the answer rather than a `KeyError`. `possibly_filter_covered` is retired in
+  the same block and for the same reason (C1-20): it counted "a filter runs here" and
+  was read as "a filter checks here".
+
 ## [3.8.0] — 2026-08-02
 
 ### Added

{sourcecode-3.8.0 → sourcecode-4.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 3.8.0
+Version: 4.0.1
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -129,6 +129,26 @@ ask spring-audit /path/to/repo
 ask migrate-check /path/to/repo --compact
 ```
 
+**Then the three that finish the sentence the four above start.** A profile-set answer stays
+conditional until you know which set the deployment starts with, a gate nobody can populate is
+a gate nobody runs, and a defect ranked without its reach is a linter note:
+
+```bash
+# Which profile set ACTUALLY runs? Reads every artefact that can set it — build,
+# descriptors, Dockerfile, Compose, Kubernetes, launch scripts — with file:line, and
+# says NOT DECIDED IN THIS REPOSITORY when nothing in the tree decides it. Then ranks
+# every admissible set by what it leaves reachable without authentication.
+ask posture /path/to/repo --resolve-environments
+
+# Derive the contracts this repository already satisfies, execute each one before
+# writing it, and populate .ask/contracts.yml from the measurement instead of by hand.
+ask verify /path/to/repo --init
+
+# What each defect actually costs once reach, access and write effect are in it:
+# severity × reachability × auth_verdict × write_effect, ordered, every factor traceable.
+ask risk /path/to/repo
+```
+
 Then the everyday loop:
 
 ```bash
@@ -145,13 +165,17 @@ ask onboard /path/to/repo
 ask review-pr /path/to/repo --since main
 
 # CI gate on NEW violations only, instead of on pre-existing debt
+ask verify /path/to/repo --init               # derive the contracts, don't hand-write them
 ask verify /path/to/repo --capture-baseline   # accept today's debt, once
 ask verify /path/to/repo                      # then: only new violations block
 ```
 
-> **Adopting a gate on a real codebase.** A repository that starts declaring contracts already
-> violates them somewhere; `ask verify` is **baseline-relative by default** (`--fail-on new`)
-> so the gate survives contact with reality instead of being switched off on day one.
+> **Adopting a gate on a real codebase.** Nobody hand-writes contracts for a 3 000-file
+> monolith, so `ask verify --init` derives the ones the repository satisfies **today** and
+> executes each before writing it — init followed by verify passes by construction.
+> A repository that starts declaring contracts already violates them somewhere; `ask verify`
+> is **baseline-relative by default** (`--fail-on new`) so the gate survives contact with
+> reality instead of being switched off on day one.
 > `ask baseline capture|diff|trend` is a different thing: versioned architectural metrics over
 > time, for trend reporting rather than blocking.
 
@@ -194,10 +218,32 @@ What a profile set **actually wires**: which conditional beans register, which d
 `ask posture` · `ask posture --diff dev:prod` · `ask posture --property k=v`
 → [posture.md](docs/posture.md)
 
+**`--resolve-environments` carries it past the edge of the repository.** Every answer above
+is conditional on a profile set, and which set runs is decided by the deployment. This flag
+reads every artefact in the tree that can set `spring.profiles.active` — Maven/Gradle,
+`web.xml`, `Dockerfile`, Compose, Kubernetes, launch scripts — with `file:line`, and returns
+`decided_in_repository`, `artefacts_disagree` (two deployments, never resolved by picking
+one) or **`NOT DECIDED IN THIS REPOSITORY`**. Then it resolves every admissible set over one
+parse and publishes the worst. A field audit closed those five hops by hand with grep before
+the flag existed.
+`ask posture . --resolve-environments`
+
 Unresolved is a first-class outcome: a condition the resolver cannot decide is reported as a
 hole with the condition named, never folded into active or inactive. **A posture answer that
 guesses is a confident security falsehood — the worst failure mode this tool has.**
 
+### 5c · Composed Risk *(experimental)*
+Every command above answers one axis, and a reader composes them by hand. `ask risk` does the
+join over the endpoint and symbol ids these commands already share with each other:
+`severity_effective = defect_severity × reachability × auth_verdict × write_effect`. The
+product of the published factors **is** the published score — decomposable to the four
+figures and the authority behind each — and an axis this build cannot measure is `unknown`,
+weighted 1.0 and named in `blind_axes` rather than silently treated as safe. Measured on a
+field case: a defect both `spring-audit` and `impact-chain` called *medium* composes to
+**high (8.06)** once *reachable unauthenticated* and *writes to the database* are in it.
+`ask risk .` · `ask risk . --min-band high` · `ask risk . --limit 10`
+→ [reference](docs/USER_GUIDE.md)
+
 ### 6 · Developer Workflows
 The everyday loop: diff-based PR review, symptom-driven bug triage, and delta context for continuous agent runs.
 `ask review-pr` · `ask fix-bug` · `ask prepare-context`
@@ -220,7 +266,7 @@ experimental: both are true, and they are two different facts.
 |---|---|---|
 | **core** | contract stable within a major — safe to gate CI on | `endpoints` · `spring-audit` · `migrate-check` · `impact` · `impact-chain` · `pr-impact` · `verify` |
 | **supported** | maintained; fields are added, never removed without a major | every command not named in another row |
-| **experimental** | shape may change in a minor — do not gate CI on it | `posture` · `archetype` |
+| **experimental** | shape may change in a minor — do not gate CI on it | `risk` · `posture` · `archetype` |
 | **parked** | kept working, no longer developed | `retrieve` |
 
 The same table is printed by `ask --help`, and both are generated from one authority
@@ -237,6 +283,7 @@ from it.
 | Command | Tier | Answers | Note |
 |---|---|---|---|
 | `posture` | experimental | which beans a profile set wires, and how effective endpoint access differs between two sets | the most differentiated capability here |
+| `risk` | experimental | what each defect actually costs, once reach, access and write effect are in it | `defect_severity × reachability × auth_verdict × write_effect`; every factor names its authority |
 | `endpoints` | core | every REST endpoint, effective path, security policy, confidence | Spring MVC + JAX-RS (~65 % recall on JAX-RS sub-resource locators) |
 | `spring-audit` | core | transactional anomalies + security surface + validation gaps | `--ci`, `-f github-comment` |
 | `migrate-check` | core | Boot 2→3 readiness: located blockers, per-dimension score, effort | `--blast-radius` orders the re-test plan |

{sourcecode-3.8.0 → sourcecode-4.0.1}/README.md

@@ -91,6 +91,26 @@ ask spring-audit /path/to/repo
 ask migrate-check /path/to/repo --compact
 ```
 
+**Then the three that finish the sentence the four above start.** A profile-set answer stays
+conditional until you know which set the deployment starts with, a gate nobody can populate is
+a gate nobody runs, and a defect ranked without its reach is a linter note:
+
+```bash
+# Which profile set ACTUALLY runs? Reads every artefact that can set it — build,
+# descriptors, Dockerfile, Compose, Kubernetes, launch scripts — with file:line, and
+# says NOT DECIDED IN THIS REPOSITORY when nothing in the tree decides it. Then ranks
+# every admissible set by what it leaves reachable without authentication.
+ask posture /path/to/repo --resolve-environments
+
+# Derive the contracts this repository already satisfies, execute each one before
+# writing it, and populate .ask/contracts.yml from the measurement instead of by hand.
+ask verify /path/to/repo --init
+
+# What each defect actually costs once reach, access and write effect are in it:
+# severity × reachability × auth_verdict × write_effect, ordered, every factor traceable.
+ask risk /path/to/repo
+```
+
 Then the everyday loop:
 
 ```bash
@@ -107,13 +127,17 @@ ask onboard /path/to/repo
 ask review-pr /path/to/repo --since main
 
 # CI gate on NEW violations only, instead of on pre-existing debt
+ask verify /path/to/repo --init               # derive the contracts, don't hand-write them
 ask verify /path/to/repo --capture-baseline   # accept today's debt, once
 ask verify /path/to/repo                      # then: only new violations block
 ```
 
-> **Adopting a gate on a real codebase.** A repository that starts declaring contracts already
-> violates them somewhere; `ask verify` is **baseline-relative by default** (`--fail-on new`)
-> so the gate survives contact with reality instead of being switched off on day one.
+> **Adopting a gate on a real codebase.** Nobody hand-writes contracts for a 3 000-file
+> monolith, so `ask verify --init` derives the ones the repository satisfies **today** and
+> executes each before writing it — init followed by verify passes by construction.
+> A repository that starts declaring contracts already violates them somewhere; `ask verify`
+> is **baseline-relative by default** (`--fail-on new`) so the gate survives contact with
+> reality instead of being switched off on day one.
 > `ask baseline capture|diff|trend` is a different thing: versioned architectural metrics over
 > time, for trend reporting rather than blocking.
 
@@ -156,10 +180,32 @@ What a profile set **actually wires**: which conditional beans register, which d
 `ask posture` · `ask posture --diff dev:prod` · `ask posture --property k=v`
 → [posture.md](docs/posture.md)
 
+**`--resolve-environments` carries it past the edge of the repository.** Every answer above
+is conditional on a profile set, and which set runs is decided by the deployment. This flag
+reads every artefact in the tree that can set `spring.profiles.active` — Maven/Gradle,
+`web.xml`, `Dockerfile`, Compose, Kubernetes, launch scripts — with `file:line`, and returns
+`decided_in_repository`, `artefacts_disagree` (two deployments, never resolved by picking
+one) or **`NOT DECIDED IN THIS REPOSITORY`**. Then it resolves every admissible set over one
+parse and publishes the worst. A field audit closed those five hops by hand with grep before
+the flag existed.
+`ask posture . --resolve-environments`
+
 Unresolved is a first-class outcome: a condition the resolver cannot decide is reported as a
 hole with the condition named, never folded into active or inactive. **A posture answer that
 guesses is a confident security falsehood — the worst failure mode this tool has.**
 
+### 5c · Composed Risk *(experimental)*
+Every command above answers one axis, and a reader composes them by hand. `ask risk` does the
+join over the endpoint and symbol ids these commands already share with each other:
+`severity_effective = defect_severity × reachability × auth_verdict × write_effect`. The
+product of the published factors **is** the published score — decomposable to the four
+figures and the authority behind each — and an axis this build cannot measure is `unknown`,
+weighted 1.0 and named in `blind_axes` rather than silently treated as safe. Measured on a
+field case: a defect both `spring-audit` and `impact-chain` called *medium* composes to
+**high (8.06)** once *reachable unauthenticated* and *writes to the database* are in it.
+`ask risk .` · `ask risk . --min-band high` · `ask risk . --limit 10`
+→ [reference](docs/USER_GUIDE.md)
+
 ### 6 · Developer Workflows
 The everyday loop: diff-based PR review, symptom-driven bug triage, and delta context for continuous agent runs.
 `ask review-pr` · `ask fix-bug` · `ask prepare-context`
@@ -182,7 +228,7 @@ experimental: both are true, and they are two different facts.
 |---|---|---|
 | **core** | contract stable within a major — safe to gate CI on | `endpoints` · `spring-audit` · `migrate-check` · `impact` · `impact-chain` · `pr-impact` · `verify` |
 | **supported** | maintained; fields are added, never removed without a major | every command not named in another row |
-| **experimental** | shape may change in a minor — do not gate CI on it | `posture` · `archetype` |
+| **experimental** | shape may change in a minor — do not gate CI on it | `risk` · `posture` · `archetype` |
 | **parked** | kept working, no longer developed | `retrieve` |
 
 The same table is printed by `ask --help`, and both are generated from one authority
@@ -199,6 +245,7 @@ from it.
 | Command | Tier | Answers | Note |
 |---|---|---|---|
 | `posture` | experimental | which beans a profile set wires, and how effective endpoint access differs between two sets | the most differentiated capability here |
+| `risk` | experimental | what each defect actually costs, once reach, access and write effect are in it | `defect_severity × reachability × auth_verdict × write_effect`; every factor names its authority |
 | `endpoints` | core | every REST endpoint, effective path, security policy, confidence | Spring MVC + JAX-RS (~65 % recall on JAX-RS sub-resource locators) |
 | `spring-audit` | core | transactional anomalies + security surface + validation gaps | `--ci`, `-f github-comment` |
 | `migrate-check` | core | Boot 2→3 readiness: located blockers, per-dimension score, effort | `--blast-radius` orders the re-test plan |

{sourcecode-3.8.0 → sourcecode-4.0.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "3.8.0"
+version = "4.0.1"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-3.8.0 → sourcecode-4.0.1}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "3.8.0"
+__version__ = "4.0.1"

{sourcecode-3.8.0 → sourcecode-4.0.1}/src/sourcecode/cache.py

@@ -354,6 +354,7 @@ def status(repo_root: Path) -> dict[str, Any]:
             "cores": 0, "snapshots": 0, "views": 0, "cas_blobs": 0,
             "total_size_bytes": 0, "total_size_mb": 0.0,
             "current_git_head": current_head,
+            "stores": _store_breakdown(repo_root, 0),
             **ris_fields,
         }
     cores = list(cache_d.glob("core-*.json.gz"))
@@ -371,10 +372,57 @@ def status(repo_root: Path) -> dict[str, Any]:
         "total_size_bytes": total_bytes,
         "total_size_mb": round(total_bytes / (1024 * 1024), 2),
         "current_git_head": current_head,
+        # C3-36: `CAS blobs: 0`, `Total size: 0.1 MB` immediately after an 89-second
+        # warm of 3 342 files. Every figure above was true and described one store
+        # of three — the warm's output mostly lands in the shared CIR and the parse
+        # cache, which this command never counted. A status that reports a third of
+        # the state reads as a warm that did nothing.
+        "stores": _store_breakdown(repo_root, total_bytes),
         **ris_fields,
     }
 
 
+def _store_breakdown(repo_root: Path, core_bytes: int) -> "dict[str, Any]":
+    """What a warm actually populated, by store. Best-effort per store: a store
+    that cannot be inspected is reported as unavailable, never as empty."""
+    out: "dict[str, Any]" = {
+        "core": {
+            "cache_dir": str(cache_dir(repo_root)),
+            "bytes": core_bytes,
+            "scope": "this repository",
+            "holds": "core snapshots, rendered views and their CAS blobs",
+        },
+    }
+    try:
+        from sourcecode.context_cache import ContextCache  # noqa: PLC0415
+
+        ctx = ContextCache.for_repo(repo_root).stats()
+        out["shared_cir"] = {
+            "cache_dir": ctx["cache_dir"],
+            "entries": ctx["contexts"],
+            "bytes": ctx["bytes_stored"],
+            "scope": "this repository",
+            "holds": "the shared Canonical IR that explain/impact/posture reuse",
+        }
+    except Exception:
+        out["shared_cir"] = {"available": False}
+    try:
+        from sourcecode import parse_cache as _pc  # noqa: PLC0415
+
+        out["parse"] = {
+            **_pc.store_stats(),
+            "holds": "per-file parses, content-addressed across every repository",
+        }
+    except Exception:
+        out["parse"] = {"available": False}
+    out["note"] = (
+        "`cache warm` populates all of these; the core store alone is a third of "
+        "the answer, and reading it as the whole is how a completed warm looks like "
+        "an empty cache."
+    )
+    return out
+
+
 def clear(repo_root: Path, *, clear_ris: bool = False) -> int:
     """Delete cache files for *repo_root*.  Returns the number of files removed.
 

{sourcecode-3.8.0 → sourcecode-4.0.1}/src/sourcecode/cache_model.py

@@ -131,6 +131,13 @@ COMMANDS: tuple[CommandCache, ...] = (
                  "builds — the parse it used to repeat for itself. `--diff` compares two profile "
                  "sets over that one IR, so the second side costs the resolution only.",
                  "10.1 s → 1.6 s"),
+    CommandCache("risk", ("cir", "parse"), "shared", False,
+                 "Composes what the audit, impact-chain and the posture already answer, so it "
+                 "pays each of their costs once over the shared CIR a warm builds — one parse "
+                 "for the whole composition, and the reachability query is cached per symbol "
+                 "within the run.",
+                 "not measured on the battery yet — the composition is bounded by the "
+                 "`spring-audit` + `impact-chain` costs listed here, not by new analysis"),
     CommandCache("endpoints", ("ris", "parse"), "shared", False,
                  "Recomputes the endpoint surface on every run, over a parse a warm has already "
                  "paid for. Until 3.7.0 the extractor parsed every file itself instead of reading "